You are correct! in order to protect, the protector has to be able to exhaust. The specific rule is as follows;

(From the Comprehensive Rules v. 7.4)
602.2 / As an attack window closes, if there is no attacker and/or no proposed defender, the combat concludes. Otherwise, any player opposed to the attacker may exhaust a character he controls that can protect the proposed defender against the attacker. This is called the Protect Point. This doesn't use the chain and is the only time a character can protect. If that happens, the proposed defender is removed from combat, and that exhausted character becomes the proposed defender and starts protecting.